Feat : Fuzzing

[naveensrinivasan]

Enabling fuzzing for sigstore.

The first steps into fuzzing Sigstore.
The goal is to integrate this into oss-fuzz using libfuzzer
https://google.github.io/oss-fuzz/getting-started/new-project-guide/go-lang/ and
https://security.googleblog.com/2021/11/clusterfuzzlite-continuous-fuzzing-for.html

Signed-off-by: naveen 172697+naveensrinivasan@users.noreply.github.com

[naveensrinivasan]

I was trying to enable fuzzing of https://github.com/sigstore/rekor ran into the tight coupling of the code and realized the ideal place to start is sigstore which is a library.

[lukehinds]

nice! thanks

could this be leveraged as a github action as well?

[bobcallaway]

+1 to the concept - @cpanato do you think it makes to implement the same hack/tools pattern in this repo as we did in rekor & fulcio?

[naveensrinivasan]

nice! thanks

could this be leveraged as a github action as well?

Yes, my thought process is crawl-walk-run. I wanted to get the initial set up done run ClusterFuzz lite as part of GitHub action for every PR and also probably as a corn job

[naveensrinivasan]

+1 to the concept - @cpanato do you think it makes to implement the same hack/tools pattern in this repo as we did in rekor & fulcio?

I agree that would be good. But can that be a refactor after this one is merged?

[naveensrinivasan]

Put the initial corpus into the workdir/corpus directory (in our case examples/png/corpus). Go-fuzz will add own inputs to the corpus directory. Consider committing the generated inputs to your source control system, this will allow you to restart go-fuzz without losing previous work.
Source https://github.com/dvyukov/go-fuzz
https://github.com/dvyukov/go-fuzz-corpus/tree/master/pem/corpus

[naveensrinivasan]

@lukehinds @dlorenc Friendly ping.

[bobcallaway]

one nit otherwise LGTM

[naveensrinivasan]

one nit otherwise LGTM

Thanks! Merged the suggestion.

[cpanato]

+1 to the concept - @cpanato do you think it makes to implement the same hack/tools pattern in this repo as we did in rekor & fulcio?

will do and propose a PR, sorry for the delay to reply, missed this notification